chore(codex): skip codex track on bootstrap-paths#18
Conversation
Bootstrap-paths (.github/workflows/**, Dockerfile, etc.) are deliberately classified as risk:blocked by pr-classify.yml — the classifier exits 1 to require admin-merge for these privilege- escalation paths. That's correct behavior for the gating signal, but in the Codex track it surfaces as: PR Codex Review / classify FAILING after 11s PR Codex Review / review SKIPPED (cascades from classify) Both are noise. Bootstrap-path PRs already require explicit admin action; a secondary Codex review adds no signal because nothing about the workflow-file diff benefits from the second-model read. Add paths-ignore so the whole Codex workflow doesn't run on these paths — no failing check appears. Verified safe: ci-workflows main ruleset requires only `review / Claude Review`. The Codex classify/review checks are NOT required, so paths-ignore does NOT create a merge deadlock. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| - ".github/dependabot.yml" | ||
| - ".github/risk-paths.yml" | ||
| - ".github/CODEOWNERS" | ||
| - "Dockerfile" |
There was a problem hiding this comment.
Bug: glob mismatch with risk-paths.yml
risk-paths.yml lists blocked: Dockerfile* (glob), so Dockerfile.dev, Dockerfile.prod, etc. all exit the classifier with risk:blocked. This entry only matches the bare Dockerfile, so a PR touching only Dockerfile.prod would still trigger the noisy failing classify check that this PR is trying to suppress.
| - "Dockerfile" | |
| - "Dockerfile*" |
| paths-ignore: | ||
| - ".github/workflows/**" | ||
| - ".github/dependabot.yml" | ||
| - ".github/risk-paths.yml" | ||
| - ".github/CODEOWNERS" | ||
| - "Dockerfile" |
There was a problem hiding this comment.
Bug: paths-ignore list is incomplete relative to risk-paths.yml blocked: section
The following paths are all blocked in .github/risk-paths.yml (causing classifier to exit 1) but are absent from this paths-ignore list. A PR that only touches these paths will still trigger the noisy failing classify check:
docker-compose*.yml/docker-compose*.yamlinfra/**terraform/**k8s/****/.env***/secrets*
The stated goal of this PR is to suppress that noise on all bootstrap paths — but these gaps mean it only partially achieves that. Suggest keeping the two lists in sync, e.g.:
| paths-ignore: | |
| - ".github/workflows/**" | |
| - ".github/dependabot.yml" | |
| - ".github/risk-paths.yml" | |
| - ".github/CODEOWNERS" | |
| - "Dockerfile" | |
| paths-ignore: | |
| - ".github/workflows/**" | |
| - ".github/dependabot.yml" | |
| - ".github/risk-paths.yml" | |
| - ".github/CODEOWNERS" | |
| - "Dockerfile*" | |
| - "docker-compose*.yml" | |
| - "docker-compose*.yaml" | |
| - "infra/**" | |
| - "terraform/**" | |
| - "k8s/**" |
|
Flagged 2 issues inline — |
1 participant
Summary
Add `paths-ignore` to `pr-codex-review.yml` so the Codex track is skipped entirely on `.github/workflows/**`, `Dockerfile`, and similar bootstrap paths. Removes the visual noise pattern user keeps hitting on workflow PRs:
```
PR Codex Review / classify FAILING (11s)
PR Codex Review / review SKIPPED
```
Why this is safe
ci-workflows main ruleset requires only `review / Claude Review`:
```bash
$ gh api repos/topcoder1/ci-workflows/rulesets/15788450
--jq '.rules[] | select(.type=="required_status_checks") | .parameters.required_status_checks[].context'
review / Claude Review
```
The Codex classify/review checks are NOT required → `paths-ignore` here does NOT create a merge deadlock (which is the standard footgun with paths-ignore on required checks).
Why skip instead of fix
Bootstrap-path PRs are blocked by design — the classifier exits 1 to require admin-merge for privilege-escalation paths. That gating signal is correct. The Codex track running on those paths would add no value: nothing about a workflow-file diff benefits from the second-model read Codex provides on application code. Better to short-circuit the whole track.
The Claude track stays on (no paths-ignore there) — that's the always-on primary review. Admins doing the manual merge still have Claude's read to consult.
After this lands
Bootstrap-path PRs will show:
Companion change in dotclaude: same paths-ignore added to the caller template so future installs ship with the fix.
🤖 Generated with Claude Code